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Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in 
the application: 

1. (Currently Amended) A method for reconstructing a path taken by 
undesirable network traffic through a computer network from a source of the traffic, the 
method comprising: 

collecting statistics at a plurality of measurement points located within routing 
and forwarding infrastructure of the computer network; and 

analyzing the statistics to reconstruct the path taken by the undesirable network 
traffic through the network from the source of the traffic. 

2. (Original) The method as claimed in claim 1 further comprising 
blocking undesirable network traffic within the computer network upstream of the points based 
on the reconstructed path. 

3. (Currently Amended) The method as claimed in claim 1 wherein the 
routing and forwarding infrastructure includes at least one router. 

4. (Original) The method as claimed in claim 1 wherein the statistics 
include flow-based statistics which provide information related to the same logical traffic flow. 

5. (Currently Amended) The method as claimed in claim 1 wherein the 
statistics include packet statistics which provide information about a set of packets entering the 
routing and forwarding infrastructure. 

6. (Original) The method as claimed in claim 1 further comprising 
requesting and receiving upstream statistics from forwarding infrastructure of the computer 
network upstream the measurement points and wherein the step of analyzing includes the step 
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of analyzing the upstream statistics to reconstruct the path taken by the undesirable network 
traffic. 

7. (Original) The method as claimed in claim 1 wherein the step of 
analyzing includes the step of extracting profiles from the statistics collected at the plurality 
of measurement points and comparing the profiles to reconstruct the path taken by the 
undesirable network traffic. 

8. (Original) The method as claimed in claim 1 wherein the computer 
network is the Internet. 

9. (Currently Amended) A system for reconstructing a path taken by 
undesirable network traffic through a computer network from a source of the traffic, the 
system comprising: 

collectors for collecting statistics at a plurality of measurement points located 
within routing and forwarding infrastructure of the computer network; and 

at least one controller in communication with the collectors for analyzing the 
statistics to reconstruct the path taken by the undesirable network traffic through the network 
from the source of the traffic. 

10. (Original) The system as claimed in claim 9 further comprising means 
in communication with the at least one controller for blocking undesirable network traffic 
within the computer network upstream of the points based on the reconstructed path. 

1 1 . (Currently Amended) The system as claimed in claun 9 wherein the 
routing and forwarding infrastructure includes at least one router. 

12. (Original) The system as claimed in claim 9 wherein the statistics 
include flow-based statistics which provide information related to the same logical traffic flow. 
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13. (Currently Amended) The system as claimed in claim 9 wherein the 
statistics include packet statistics which provide information about a set of packets entering the 
routing and forwarding infrastructure. 

14. (Original) The system as claimed in claim 9 further comprising means 
for requesting and receiving upstream statistics from forwarding infrastructure of the computer 
network upstream the measurement points and wherein the at least one controller analyzes the 
upstream statistics to reconstruct the path taken by the undesirable network traffic. 

15. (Original) The system as claimed in claim 9 wherein the controller 
extracts profiles from the statistics collected at the plurality of measurement points and 
compares the profiles to reconstruct the path taken by the undesirable network traffic. 

16. (Original) The system as claimed in claim 9 wherein the computer 
network is the Internet. 

17. (Original) The method as clauned in claim 1 wherein the undesirable 
network traffic includes denial of service attacks. 

18. (Original) The method as claimed in claim 17 wherein the computer 
network includes a plurality of service provider networks. 

19. (Original) The system as claimed in claim 9 wherein the undesirable 
network traffic includes denial of service attacks. 

20. (Original) The system as claimed in claim 19 wherein the computer 
network includes a plurality of service provider networks. 



